In past articles I wrote how Python is useless for side-channel free programming and how you can debug code written with side-channel free processing in mind. But, you may ask how realistic are att…| securitypitfalls
Few days ago I have published research that used statistical methods to test for timing side-channel leaks in RSA key exchange in TLS, in the Marvin Attack paper. In this blog post I’ll descr…| securitypitfalls
Two years ago, I wrote how RAID doesn’t work, as it’s unable to detect silent data corruption. We tried to see what happens if we inject data corruption and unfortunately Linux 4.16.6 w…| securitypitfalls
Note: while the conclusions from this article are correct (as the side channels measured are relatively large), the statistical methods used for doing that are NOT. See the later article Debugging …| securitypitfalls
Now, that we have the clickbaity title out of the way, let’s talk about data integrity. Specifically, disk data integrity on Linux. RAID, or as it is less well known, Redundant Array of Indep…| securitypitfalls
Diffie-Hellman key agreement protocol uses modular exponentiation and calls for use of special prime numbers. If you ever wondered why, I’ll try to explain. Diffie-Hellman key agreement The &…| securitypitfalls
SSL/TLS survey of 637373 websites from Alexa’s top 1 million Stats only from connections that did provide valid certificates (or anonymous DH from servers that do also have valid certificate …| securitypitfalls
SSL/TLS survey of 482427 websites from Alexa’s top 1 million Stats only from connections that did provide valid certificates (or anonymous DH from servers that do also have valid certificate …| securitypitfalls
SSL/TLS survey of 610687 websites from Alexa’s top 1 million Stats only from connections that did provide valid certificates (or anonymous DH from servers that do also have valid certificate …| securitypitfalls
There are additional tests performed against the servers, “last ext empty” is when the server rejects connections with last extension in Client Hello being empty. Test with “more …| securitypitfalls
